b52ddada046432cc77db5589e8bb19231371559d1663c100cb1a2d9b294d6e88

Analysis

max time kernel
14s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 03:12

Target

b52ddada046432cc77db5589e8bb19231371559d1663c100cb1a2d9b294d6e88.dll
Size

7KB
MD5

aa8579003d724e321ff75d8929bc50de
SHA1

d3d916b17214d6de3df175e0635b7af9011d6d7d
SHA256

b52ddada046432cc77db5589e8bb19231371559d1663c100cb1a2d9b294d6e88
SHA512

a0e35d11648ea122f461da097f9aa3bc340fe3d8dab989b881aeb4c312bf0b468c0587cb23e01668a1c06705b0d6256f25fcd87e43a6b773a8b1150c715ecdd9
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWXbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPJq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30
PID 2372 wrote to memory of 2432	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b52ddada046432cc77db5589e8bb19231371559d1663c100cb1a2d9b294d6e88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b52ddada046432cc77db5589e8bb19231371559d1663c100cb1a2d9b294d6e88.dll,#1
  2⤵
  PID:2432